- 21 May, 2017 3 commits
-
-
Andy Polyakov authored
Switch to TAP::Harness inadvertently masked test failures. Test::Harness::runtests was terminating with non-zero exit code in case of failure[s], while TAP::Harness apparently holds caller responsible for doing so. Reviewed-by:
Rich Salz <rsalz@openssl.org>
-
Andy Polyakov authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3502)
-
Todd Short authored
Remove assertion when mmap() fails. Only run the 1<<31 limit test on Linux Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3455)
-
- 20 May, 2017 5 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3500)
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3500)
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3500)
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3500)
-
Rich Salz authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3491)
-
- 19 May, 2017 9 commits
-
-
Dr. Stephen Henson authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3451)
-
Dr. Stephen Henson authored
Import test data from sha1test.c, sha256t.c and sha512t.c which is from RFC6234 section 8.5 Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3451)
-
Dr. Stephen Henson authored
Allow multiple "Input" lines to call the update function multiple times. Add "Ncopy" keyword to copy the input buffer. So for example: Input = "a" Ncopy = 1024 Will create a buffer consisting of 1024 "a" characters. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3451)
-
Matt Caswell authored
The return code from tls1_mac is supposed to be a boolean 0 for fail, 1 for success. In one place we returned -1 on error. This would cause code calling the mac function to erroneously see this as a success (because a non-zero value is being treated as success in all call sites). Fortunately, AFAICT, the place that returns -1 can only happen on an internal error so is not under attacker control. Additionally this code only appears in master. In 1.1.0 the return codes are treated differently. Therefore there are no security implications. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3495)
-
Pauli authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3465)
-
Diego Santa Cruz authored
With the -list option the srp app loops on the main while() endlessly, whether users were given on the command line or not. The loop should be stopped when in list mode and there are no more users. Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3489)
-
Matt Caswell authored
Fixes #1526 Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3360)
-
Matt Caswell authored
Fixes #1526 Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3360)
-
Matt Caswell authored
We are quite inconsistent about which alerts get sent. Specifically, these alerts should be used (normally) in the following circumstances: SSL_AD_DECODE_ERROR = The peer sent a syntactically incorrect message SSL_AD_ILLEGAL_PARAMETER = The peer sent a message which was syntactically correct, but a parameter given is invalid for the context SSL_AD_HANDSHAKE_FAILURE = The peer's messages were syntactically and semantically correct, but the parameters provided were unacceptable to us (e.g. because we do not support the requested parameters) SSL_AD_INTERNAL_ERROR = We messed up (e.g. malloc failure) The standards themselves aren't always consistent but I think the above represents the best interpretation. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3480)
-
- 18 May, 2017 1 commit
-
-
Matt Caswell authored
add_key_share() is a helper function used during key_share extension construction. It is expected to be a simple boolean success/fail return. It shouldn't be using the new EXT_RETURN type but it was partially converted anyway. This changes it back. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3488)
-
- 17 May, 2017 9 commits
-
-
Paul Yang authored
recocognised -> recognised CLA: trivial Signed-off-by:
Paul Yang <paulyang.inf@gmail.com> Reviewed-by:
Andy Polyakov <appro@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3470)
-
Todd Short authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3416)
-
Matt Caswell authored
Check that a missing sig algs extension succeeds if we are resuming. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3478)
-
Matt Caswell authored
The current TLSv1.3 spec says: 'If a server is authenticating via a certificate and the client has not sent a "signature_algorithms" extension, then the server MUST abort the handshake with a "missing_extension" alert (see Section 8.2).' If we are resuming then we are not "authenticating via a certificate" but we were still aborting with the missing_extension alert if sig algs was missing. This commit ensures that we only send the alert if we are not resuming. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3478)
-
Matt Caswell authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3418)
-
Matt Caswell authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3418)
-
Matt Caswell authored
We already did this on an ad-hoc per extension basis (for some extensions). This centralises it and makes sure we do it for all extensions. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3418)
-
Richard Levitte authored
Notifications can be (and should be) configured on account basis on the CI web site. This avoids getting emails to openssl-commits for personal accounts that also build OpenSSL stuff. Reviewed-by:
Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3484)
-
Matt Caswell authored
An alert message is 2 bytes long. In theory it is permissible in SSLv3 - TLSv1.2 to fragment such alerts across multiple records (some of which could be empty). In practice it make no sense to send an empty alert record, or to fragment one. TLSv1.3 prohibts this altogether and other libraries (BoringSSL, NSS) do not support this at all. Supporting it adds significant complexity to the record layer, and its removal is unlikely to cause inter-operability issues. The DTLS code for this never worked anyway and it is not supported at a protocol level for DTLS. Similarly fragmented DTLS handshake records only work at a protocol level where at least the handshake message header exists within the record. DTLS code existed for trying to handle fragmented handshake records smaller than this size. This code didn't work either so has also been removed. Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3476)
-
- 16 May, 2017 1 commit
-
-
Rich Salz authored
Allow multiple file arguments. Split bntests.txt into separate files. Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3471)
-
- 15 May, 2017 7 commits
-
-
Tomas Mraz authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3442)
-
Tomas Mraz authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3442)
-
Tomas Mraz authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3442)
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3469)
-
Richard Levitte authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3468)
-
Pauli authored
[extended tests] Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3393)
-
Pauli authored
Reviewed-by:
Rich Salz <rsalz@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3393)
-
- 12 May, 2017 5 commits
-
-
Rich Salz authored
Suppose OPENSSL_USE_NODELETE (via Nick Reilly) Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3399)
-
Rich Salz authored
Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3399)
-
Rich Salz authored
Reviewed-by:
Stephen Henson <steve@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3454)
-
Todd Short authored
Reviewed-by:
Matt Caswell <matt@openssl.org> Reviewed-by:
Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3439)
-
Rich Salz authored
Reviewed-by:
Stephen Henson <steve@openssl.org> Reviewed-by:
Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3452)
-